shasum is also required and must be handled

[rfay]

This add-on requires shasum in addition to jq and friends; we need to check for it, and also eventually move it into docker-provided space.